[PATCH 5.4 07/67] io_uring: Fix use-after-free in io_sq_wq_submit_work()

[Greg Kroah-Hartman]

From: Guoyu Huang <hgy5...@gmail.com>

when ctx->sqo_mm is zero, io_sq_wq_submit_work() frees 'req'
without deleting it from 'task_list'. After that, 'req' is
accessed in io_ring_ctx_wait_and_kill() which lead to
a use-after-free.

Signed-off-by: Guoyu Huang <hgy5...@gmail.com>
Signed-off-by: Jens Axboe <ax...@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 fs/io_uring.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2232,6 +2232,7 @@ restart:
                if (io_req_needs_user(req) && !cur_mm) {
                        if (!mmget_not_zero(ctx->sqo_mm)) {
                                ret = -EFAULT;
+                               goto end_req;
                        } else {
                                cur_mm = ctx->sqo_mm;
                                use_mm(cur_mm);